Netconf enabled Platform Options

This page offers details on how the netconf connection works in Ansible and how to use it.

Connections Available

NETCONFall modules except junos_netconf,which enables NETCONF
ProtocolXML over SSH
Credentialsuses SSH keys / SSH-agent if presentaccepts -u myuser -k if using password
Indirect Accessvia a bastion (jump host)
Connection Settingsansible_connection: netconf

For legacy playbooks, Ansible still supports ansible_connection=local for the netconf_config module only. We recommend modernizing to use ansible_connection=netconf as soon as possible.

Using NETCONF in Ansible

Enabling NETCONF

Before you can use NETCONF to connect to a switch, you must:

  • install the ncclient Python package on your control node(s) with pip install ncclient
  • enable NETCONF on the Junos OS device(s)

To enable NETCONF on a new switch via Ansible, use the platform specific module via the CLI connection or set it manually.For example set up your platform-level variables just like in the CLI example above, then run a playbook task like this:

  1. - name: Enable NETCONF
  2.   connection: network_cli
  3.   junos_netconf:
  4.   when: ansible_network_os == 'junos'

Once NETCONF is enabled, change your variables to use the NETCONF connection.

Example NETCONF inventory [junos:vars]

  1. [junos:vars]
  2. ansible_connection=netconf
  3. ansible_network_os=junos
  4. ansible_user=myuser
  5. ansible_password=!vault |

Example NETCONF Task

  1. - name: Backup current switch config
  2.   netconf_config:
  3.     backup: yes
  4.   register: backup_junos_location

Example NETCONF Task with configurable variables

  1. - name: configure interface while providing different private key file path
  2.   netconf_config:
  3.     backup: yes
  4.   register: backup_junos_location
  5.   vars:
  6.     ansible_private_key_file: /home/admin/.ssh/newprivatekeyfile

Note: For netconf connection plugin configurable variables see netconf.

Bastion/Jumphost Configuration

To use a jump host to connect to a NETCONF enabled device you must set the ANSIBLE_NETCONF_SSH_CONFIG environment variable.

  • ANSIBLE_NETCONF_SSH_CONFIG can be set to either:
    • 1 or TRUE (to trigger the use of the default SSH config file ~/.ssh/config)
    • The absolute path to a custom SSH config file.

The SSH config file should look something like:

  1. Host *
  2.   proxycommand ssh -o StrictHostKeyChecking=no -W %h:%p [email protected]
  3.   StrictHostKeyChecking no

Authentication for the jump host must use key based authentication.

You can either specify the private key used in the SSH config file:

  1. IdentityFile "/absolute/path/to/private-key.pem"

Or you can use an ssh-agent.

ansible_network_os auto-detection

If ansible_network_os is not specified for a host, then Ansible will attempt to automatically detect what network_os plugin to use.

ansible_network_os auto-detection can also be triggered by using auto as the ansible_network_os. (Note: Previously default was used instead of auto).

Warning

Never store passwords in plain text. We recommend using SSH keys to authenticate SSH connections. Ansible supports ssh-agent to manage your SSH keys. If you must use passwords to authenticate SSH connections, we recommend encrypting them with Ansible Vault.